Patch management for software within critical infrastructure is daunting. Prolonged patch cycles, downtime, and resource-intensive updates can all leave systems vulnerable for far longer than is acceptable.

That doesn’t mean you shouldn’t patch, but you should seek out options to protect devices and embedded systems even before a patch is available. For example, runtime protections are a welcome addition to your ICS/OT patch management strategy, particularly with threat actors like Volt Typhoon targeting critical infrastructure.

The Challenges of ICS/OT Patch Management

Patching vulnerabilities in critical systems involves far more complexity than issuing updates for standard IT environments. The stakes are higher, and the constraints are substantial, particularly in OT environments. 

Why Is Traditional Patching So Challenging?

1. Downtime Is Expensive and Risky
Critical infrastructure systems in industries like energy, industrial automation, and manufacturing simply cannot afford prolonged downtime. Stopping operations, even briefly, to patch a system could disrupt essential services and impact public safety. 

2. Managing Legacy Systems and Compatibility Issues
Many critical infrastructure systems are built on aging or bespoke software that may not support new patches. Applying updates could introduce unintended errors or reduce system functionality.

3. Addressing Lengthy Patch Cycles
For complex OT systems, patch development, testing, and deployment can take months. This leaves systems exposed to vulnerabilities for extended periods and makes them highly attractive targets for attacks.

Why ICS/OT Systems Need More Than Patches

While patching remains an industry-standard practice, patch-only strategies leave businesses at significant risk. Three key shortcomings make traditional patching insufficient for critical infrastructure systems:

1. Delayed Vulnerability Resolution
Even when patches are eventually issued, adversaries exploit the lag between vulnerability discovery and patch deployment. This leaves OT systems particularly vulnerable to attacks, as demonstrated by global ransomware campaigns and nation-state actors that have targeted unpatched critical infrastructure.

2. Incomplete Coverage
While patching resolves known vulnerabilities, it does not protect against future attacks or zero days in software.

3. Excessive Resource Burden
Security teams spend countless hours addressing vulnerabilities rather than focusing on proactive strategies. This creates fatigue among teams and diverts resources from long-term improvements. 

An Alternative Strategy for Mitigating Vulnerabilities

Given these challenges, organizations can benefit from proactive solutions that complement patching to provide stronger defenses against vulnerabilities, even before a patch is available.

One solution is runtime exploit prevention, which defends devices by mitigating vulnerabilities at runtime rather than relying on patches. Runtime exploit prevention is specifically effective against various high-risk vulnerabilities, including:

• Memory Corruption Exploits: Prevents buffer overflows, heap overflows, stack-based attacks, and other memory safety vulnerabilities.
• Return-Oriented Programming (ROP): Disrupts attackers’ ability to exploit pre-existing instructions within an application.
• Use-After-Free Exploits: Mitigates common vulnerabilities by randomizing memory layouts, rendering leaked addresses useless.
• Code Injection Attempts: Detects and blocks malicious instructions before execution.
• Zero-Day Vulnerabilities: Provides protection for memory-based zero days even when the vulnerability is unknown at the time of deployment.

A single unpatched vulnerability in SCADA or HMI systems could allow attackers to compromise an entire facility, leading to catastrophic outcomes.  With runtime protections applied, many of these exploits can be prevented, significantly reducing risk to critical systems.

Case Studies: Successful Alternatives to Patching

Defending HMIs: HMI products are the most commonly attacked OT network devices, use a variety of operating systems, and are often in very difficult to update facilities within critical infrastructure. One industrial automation leader deployed runtime protection to HMI products built on embedded Linux, significantly reducing the attack surface without altering product functionality. Additionally, with runtime protections applied, the organization now has protection against memory-based zero days, which means devices are protected even before a patch is available and applied. 

Embedded Systems Protection: In another example, Vertiv, a leading global provider of digital infrastructure and continuity solutions, integrated RunSafe Security’s runtime protection software as a layer into their Yocto builds to enable self-protection against memory-based attacks. RunSafe’s integration into Vertiv’s GitLab environment automated the identification and mitigation of vulnerabilities, centralizing vulnerability management and protection devices against zero days.

Future-Proofing Critical Infrastructure Security

Securing software and devices deployed across critical infrastructure is a multifaceted challenge, especially as attackers become more sophisticated. While patching remains essential, modern infrastructure operators cannot rely on it as their sole defense strategy. 

Complementary solutions, like runtime protections, empower security teams to transition from a reactive stance to proactive, strategic defense planning. 

Want to minimize your patching cycles and defend your systems against memory-based vulnerabilities? Explore how RunSafe Protect can strengthen your patch management strategy and safeguard your devices.